Repository navigation
Allow public page access to apps with group restrictions on #5309
Description
Currently, when group restrictions are on, it is not possible to have a controller method declared as public page because the security middleware checks if the app is enabled for the user unconditionally.
Although, when group restrictions are disabled, then \OC_App::isEnabled($this->appName) returns true making it possible to access a public controller method.
However, an app might need to make a method public even when group restrictions are on. My use case is nextcloud/richdocuments where the document editing service requires to download the document from nextcloud to be able to edit it. Since it has no user context, it downloads the file (and does some other stuff too) via a public controller method, which fails when group restrictions are on.
I think we may need to introduce a new annotation here and then guard the security middleware method there with it.
Activity
julien-nc commentedon Jan 31, 2018
Did you find a solution ? I'm looking for a way to allow public pages to my apps (PhoneTrack and GpxPod) when there are group restrictions...
julien-nc commentedon Feb 28, 2018
There is a duplicate of this issue : #6962
refs nextcloud#6962, refs nextcloud#5309; do not throw AppNotEnabledE…
refs nextcloud#6962, refs nextcloud#5309; do not throw AppNotEnabledE…
Do not throw AppNotEnabledException for app public pages - refs nextc…
Do not throw AppNotEnabledException for app public pages - refs nextc…
julien-nc commentedon Mar 7, 2018
#8593 partially fixes the problem : Routing system is still redirecting users who are not in any authorized group when they try to access to public pages of restricted apps. I'll try to find where to fix that.
szaimen commentedon May 21, 2021
I suppose this issue is still valid? If not, please close this issue!
Rello commentedon Jan 13, 2025
this issue is still valid